What Happened Part 1 (2013)
Inception Late January 4th, 2013, an image was posted to 4chan's /x/ (paranormal) board. The image read: Hello again. Our search for intelligent individuals now continues. The first clue is hidden within this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301 Analysis of the image The image was processed by the steganographic tool outguess. This message was the result. A more analytic look reveals the use of a book cipher. To decrypt the message, one needs to find the text that was used for encrypting. A book whose study is forbidden Once dictated to a beast; To be read once and then destroyed Or you shall have no peace. This poem, introducing the secret message, was a nudge towards the right text. After a bit of debate, the text that was used to encrypt the book cipher was discovered. ''Liber AL vel Legis'', aka The Book of the Law The book that was used to hide the message was Liber AL vel Legis by Alester Crowley. Also known as "The Book Of Law", it is available online, and can be found here . The first line I:1:6 points toward the 6th character of the first line in the first chapter, an 'h' in this case. It was assumed that spaces weren't counted. Punctuation, however, influenced the character chosen for the plaintext. During decrypting, we found that dashes were vital to the process, so we kept them in the plaintext. Using these rules, we encrypted the book cipher and came up with the decrypted message. https:--www.dropbox.com-s-r7sgeb5dtmzj14s-3301 We agreed upon substituting the dashes with slashes. The Dropbox Link The hyperlink directed to a dropbox address with a file of 130MB ready for download. After downloading, the file was analysed and a quick check for magic bytes revealed, that the offered file was an .iso image. The Image, the Song and the Boot sequence The image was downloaded by multiple people and either burned to disc to run on a computer or opened in a virtual drive. Looking into its contents, we find three directories, "data", "boot" and "audio". The folder "audio" contained an audio recording. The title of the recording was "761.mp3" and can be downloaded here. The ID3 tags show us that the title of the file is "The Instar Emergence" and the artist "3301". To our knowledge, the used instrument is a guitar, with strange effects on it, one of the identified effects is reversing. Some people claimed the key of the recording to be G#. You can listen to the song here: A hexdump of the audio revealed the following message: Parable 1,595,277,641 Like the instar, tunneling to the surface We must shed our own circumferences; Find the divinity within and emerge. The original message had "\n" attached to the end of each line. This character sequence is used to indicate a new line in some programming languages. These were omitted due to the availability of proper formatting techniques. When booting from the image, a boot sequence appeared, printing a sequence of numbers to the screen. Investigating the sequence revealed, that the live image prints out all prime numbers up to 3301. There were temporary pauses at 1033 and 3301, where it stops at the latter and moves to the second stage. The next, and last stage of the procedure is a screen that reads: @1231507051321 The key is all around you. Good luck. 3301 A video of the boot process can be found here: Further analysis of the live image turned up the routine responsible for the display of the prime numbers. It is a linux shell script, which, luckily, is human-readable. It does not calculate prime numbers, like some suggested, but connected the printing command with a sleep command. In most cases, the sleep time is 0.5 seconds. In case of the primes 1033 and 3301 however, the sleep time is 2 seconds, which manifested the relevance of those two numbers. Also found in the image was this PGP signature. The original dump can be found here. The Twitter While people still searched through the image to find more hints that may have been overlooked, somebody in the IRC found a twitter account which got our attention, to say the least. Multiple things were strange about that twitter. It fits the overall "style" of cicada, it was registered shortly after the first downloads of the live image and had had no followers. The most striking thing about it though was the messages it tweeted. The messages were introduced by a hex number, which can be described by the Python function hex(number_of_tweet * 65) # padded to a length of 7 So the first tweet had the "header" 000000, the second tweet had the header 0000041, the third had the header 0000065 and so on. This was followed by a colon and, what is currently believed to be, the body of the message. This body consisted of 130 characters, ranging from A-F and 0-9, matching the hexadecimal representation of values. Converting the hexadecimal values to binary, we get 65 byte per tweet. The meaning of the messages is heavily debated among the solvers. While some believe it is an encryption technique with the key to be found somewhere in the information from the live image, others suggested a huffman encoding process. So far, no progress has been made on the interpretation of the tweets. The tweets come in 5 minute intervals. Category:The Twitter Category:The Twitter